Bitget Hacker Laundered $78.6M in Bitcoin, 80% Through CoinJoin

The hacker behind Bitget's September breach moved 1,052.34 BTC — $78.61 million — out of labeled wallets between Nov. 6 and Nov. 11, with roughly 80.5% of the funds pushed through CoinJoin transactions, according to on-chain tracing by blockchain intelligence firm Arkham. The pace accelerated rather than slowed: the final day's outflow was more than double the first day's, even though reporting cutoff fell before midday UTC.

Arkham's update, shared in a thread dated Nov. 12, traced $63.43 million into CoinJoin transactions beginning at 09:27 UTC on Nov. 6. Of the 847.26 BTC that entered CoinJoin, 579.80 BTC worth $43.59 million came directly from labeled wallets. Another 267.46 BTC, valued at $19.84 million, traveled through fresh addresses over one to six hops before joining the mixing pools. The claim of 80% obfuscation is Arkham's attribution; CoinJoin by design hides the input-to-output link, so downstream tracing may prove harder, not impossible.

How fast did the funds move?

Average outflows ran at 175.39 BTC, or $13.10 million, per day across the six-day window. The daily pattern was uneven:

• Nov. 6: 137.71 BTC ($10.47 million)
• Nov. 7: 156.04 BTC ($11.86 million)
• Nov. 8: 16.75 BTC ($1.27 million)
• Nov. 9: 206.31 BTC
• Nov. 10: 238.79 BTC
• Nov. 11: 296.74 BTC ($21.83 million) by 11:58 UTC

The Nov. 8 pause lasted one day. Whether it reflects operational caution or an unrelated interruption, Arkham's data does not say.

What remains untracked?

At the latest snapshot, 959.29 BTC worth $71.44 million remained in tracked wallets. Bitcoin represented more than 99% of a $71.86 million portfolio, of which Arkham classified roughly $339,320 as frozen and $71.52 million as liquid. Residual holdings included 241,026 USDT, 134,456 USDC, and 18.358 ETH, with smaller positions in TRX and USDD.

Arkham classified a further 205.08 BTC, worth $15.18 million, as moved but not CoinJoined. Of that, 172.33 BTC worth $12.72 million sat unspent across 250 addresses, while 16.38 BTC valued at $1.22 million was still moving at six hops. The breakdown also listed 10 BTC, about $760,000, sent to Maya Protocol, and 4.37 BTC worth $330,500 split across 433 small outputs — a dust pattern consistent with further fragmentation.

Is this a new laundering strategy?

The scale is new; the method is not. In September, AMLBot linked roughly four BTC to CoinJoin after following funds from TRON through USDT0, Ethereum and THORChain, describing that route as an apparent effort to obscure stolen assets. The WabiSabi protocol documentation, which underpins modern CoinJoin coordination, describes transactions that combine participants' Bitcoin inputs and produce outputs without exposing a direct link to the coordinator or other participants.

Earlier tracing showed a smaller, quieter phase. On Oct. 24, crypto.news reported that Arkham had tracked $19.48 million in transfers between Oct. 21 and Oct. 24, with almost all funds going to new addresses and no exchange or mixer identified as recipient. At that snapshot, Arkham valued remaining labeled holdings at $242.54 million, including 2,960.01 BTC — a figure the latest screenshots show has shrunk considerably.

What is Bitget doing about it?

The movements trace back to the Sept. 24 breach, which Bitget initially valued at $351.6 million before revising the transferred-assets total to $387.5 million. The exchange said the revision included Zcash and TRON assets omitted from the first calculation and did not represent further unauthorized withdrawals. Bitget named Mandiant and SlowMist as investigation partners and said it had identified and fixed the underlying vulnerability.

Bitget's recovery bounty program offers eligible participants 5% of funds they directly help freeze and a separate 5% of funds they directly help recover. The company itself determines eligibility, contributions and payments, and actions taken under court orders, law enforcement requests or other legal processes are excluded. A bounty structure the exchange controls unilaterally is a promise with conditions attached.

With more than $71 million still liquid in labeled wallets and daily outflows trending upward through Nov. 11, the coming weeks will show whether investigators can trace CoinJoin outputs fast enough to freeze funds before they reach cash-out venues.